Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode.

I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline Root CA if possible.

Given that I've never used a HSM before, and am lacking in concepts on how it's typically used, my efforts to find a "cheaper shortcut" to the same end may result in more pain than it's worth.

Can someone enlighten me on this HSM mode and what general steps are required to make this compatible with a CA, be it Microsoft CA, or any other one that can be acquired.

share|improve this question

Technically no, although it depends on what you mean by "secure".

Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, this ensures that even if the host machine is fully hijacked by an attacker and/or the attacker has physical access to the CA machine, then the attacker will not obtain a copy of the private key. At best he will be able to use the HSM to generate arbitrary signatures, but if the HSM is physically recovered then the attacker can know longer use the private key.

YubiHSM does not do RSA or DSA or any other algorithm relevant to asymmetric cryptography. YubiHSM is symmetric only (AES...). Thus, if you used it for a CA private key, then it would have to be along these lines: the RSA private key would be stored encrypted, and the symmetric key stored in the YubiHSM. However, when the private key would have to be used, it would first be loaded and decrypted in the RAM of the host machine, and that machine would then use its CPU to generate the signature.

I am not aware of any existing driver (Windows CSP, PKCS#11 driver...) which would make the necessary glue, but, in any case, it would void much of the interest of using a "HSM" since it, by nature, allows the private key to live outside of the tamper-resistant hardware.

YubiHSM is meant to support things like one-time passwords, not X.509 certificate authorities. A cheap alternative to a full HSM would rather be a smart card: that kind of hardware includes cryptographic accelerators which allow for efficient generation, storage and usage of asymmetric key pairs.

share|improve this answer

I'm not sure exactly what you want to protect if the root CA delegated signing and if it's offline. And I don't think this YubiHSM can protect x.509 out of e box, however, you might want to talk to your architect about your concerns with your CA infrastructure and read some limitations and features in the manual.

manual on Yubikey HSM

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.